为什么我从App Engine获取Google API调用的invalid_grant？ [英] Why am I getting invalid_grant for Google API calls from App Engine?

问题描述

我试图从App Engine访问Google Prediction API，并按照此处的说明操作 -
https://developers.google.com/appengine/articles/prediction_service_accounts

I'm trying to access Google Prediction API from App Engine and following instructions here -- https://developers.google.com/appengine/articles/prediction_service_accounts

这在部署在App Engine上时效果很好。

This works great when deployed on App Engine. The same code, however, fails with the following error on the local devserver.

credentials = AppAssertionCredentials(
              scope='https://www.googleapis.com/auth/prediction')
http = credentials.authorize(httplib2.Http(memcache))
service = build("prediction", "v1.5", http=http, developerKey=api_key)

ERROR    2012-12-28 03:48:53,084 client.py:461] Failed to retrieve access token: {
  "error" : "invalid_grant"
}
ERROR    2012-12-28 03:48:53,115 cgi.py:121] Traceback (most recent call last):
  File "/Users/gkedia/git/thirdgaze/main.py", line 83, in <module>
    service = build('prediction', 'v1.5', http=http, developerKey=api_key)
  File "/Users/gkedia/git/thirdgaze/apiclient/discovery.py", line 175, in build
    resp, content = http.request(requested_url)
  File "/Users/gkedia/git/thirdgaze/oauth2client/client.py", line 503, in new_request
    self._refresh(request_orig)
  File "/Users/gkedia/git/thirdgaze/oauth2client/client.py", line 412, in _refresh
    self._do_refresh_request(http_request)
  File "/Users/gkedia/git/thirdgaze/oauth2client/client.py", line 472, in _do_refresh_request
    raise AccessTokenRefreshError(error_msg)
AccessTokenRefreshError: invalid_grant

我注意到的其中一件事情是为了完全相同的参数， key_name，signature = app_identity.sign_blob（base_str）返回在生产和本地机器上签名不同。

One of the things I noticed was for the exact same parameters, key_name, signature = app_identity.sign_blob(base_str) returns different signature in production and on local machine.

我的电脑时间正确同步，offline_access参数ter似乎还没有涉及。

My computer's time is sync'ed correctly and offline_access parameter doesn't seem to be involved yet.

推荐答案

app_identity 和更一般的服务帐户将无法在 dev_appserver 上工作，您将不得不使用常规的 oauth2 webserver flow ，以便在本地测试时获得与常规Google帐户关联的访问令牌。

app_identity and more generally service account won't work on dev_appserver you would have to fallback a regular oauth2 webserver flow in order to get an access token associated with a regular Google Account when testing locally.

类似于：

Something like:

flow = OAuth2WebServerFlow(client_id='your_client_id',
                           client_secret='your_client_secret',
                           scope='https://www.googleapis.com/auth/prediction',
                           redirect_uri='http://localhost:8080/oauth2callback')
self.redirect(flow.step1_get_authorize_url())

然后在 / oauth2callback 处理程序：

credentials = flow.step2_exchange(self.request.get('code'))
http = credentials.authorize(httplib2.Http(memcache))
service = build("prediction", "v1.5", http=http, developerKey=api_key)

您可以轻松检测您是否正在运行 dev_appserver 或在生产中使用 SERVER_SOFTWARE 环境变量。

You can easily detect if you are running on the dev_appserver or in production using SERVER_SOFTWARE environment variable.

这篇关于为什么我从App Engine获取Google API调用的invalid_grant？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！